Refuse an image URL whose source path or query holds a # (closes #286)

A # written as %23 reached the parser decoded and stayed in the source
path or query. The source URL built from it ended at the # when it was
fetched, so each text after it fetched the same upstream image, without
a signature for an allowlisted host, and cached it under keys of its
own. Such a URL is now refused with 400, and README.md says neither the
source path nor the source query may hold a #.

Model: opus-5-5

TODO.md

@@ -30,6 +30,11 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-15 a `/v1/image/` URL whose source path or source query holds a `#`,
+  written as `%23`, is refused with 400 (closes #286): the source URL built from
+  it ended at the `#` when fetched, so each text after it fetched the same
+  upstream image, without a signature for an allowlisted host, and cached it
+  under keys of its own. `README.md` says neither may hold a `#`.
 - 2026-10-15 the host of a `/v1/image/` URL must be a host name or an IPv4
   address (letters, digits, hyphens, underscores and dots) or an IPv6 address in
   brackets, either one optionally followed by `:` and a port, and any other host